CISA Question 418

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C2

  C is the correct answer over D because testing with actual data verifies whether the application's controls function as intended in real execution, whereas code review only analyzes the logic without confirming its practical effectiveness.

• Chose C1

  Using test data is the most appropriate technique for verifying application program controls because it allows an IS auditor to simulate various input scenarios and evaluate how the application processes the data. This technique helps to verify whether controls, such as validation, authorization, and processing logic, are functioning as intended. Test data can include both valid and invalid inputs to check how the system handles different cases, ensuring the application enforces controls correctly.

• Chose C1

  it allows the IS auditor to simulate real-world scenarios and evaluate how the application processes data under various conditions. This method helps determine whether the controls embedded in the application are functioning as intended.